McAfee Data Loss Prevention 9.2.2 Product Guide

Managing conceptsAdd, apply, restore, and delete concepts 114 Type in a name (uppercase only) and optional description.5 Select an algorithm to ensure self‐correction of incorrectly entered parameters.For example, if you create a MasterCard expression that uses an incorrect numbering sequence,the algorithm will ignore the pattern and replace it with the correct sequence.6 Click ? to file the concept under a category.All concepts in a category can be used in queries and rules.7 If you want to upload a list of existing expressions or patterns, click Browse and select the file.8 Click Import Expressions to load expressions from a file, or enter expressions in the Expression field.Escape all metacharacters to ensure literal interpretation (for example, www\.deadspin\.com).9 If you want to edit the list of expressions, or just keep a copy, click Export Expressions to save them toyour desktop. You can debug them in a text editor, then reimport.10 If you don't have a document to upload, or want to use text and regular expressions to build a newconcept, enter a value in the Expression 0: field. Click + to add an expression, and repeat until allexpressions are added.11 Click Validate, then enter a sample string. If it matches, go on to the next step. The Matches Stringreturns a true or false acknowledgement.12 Use one of the concept conditions (Count, Percentage Match, Number of lines/bytes, Proximity) to modify theaction of the concept.Concept conditions narrow the match to specific circumstances. For example, if you want thesystem to wait until the concept conditions are found three times before being reported to thedashboard, select greater than from the Condition menu, and enter 3 in the value field.13 Click Save.When creating concepts that have multiple words, you must escape spaces between words with abackslash (for example, hello\_world). Other metacharacters and ASCII characters (such as&#x0020, &#x0009, &#x000C, and &#x200B for space, tab, form feed, and zero‐width space) can alsobe used to define concept expressions.Apply concepts to rulesApply content concepts to rule definitions to match patterns in data traffic or repositories.The rule definition might contain many parameters, one of which might be a pattern defined in aconcept. For example, the HATE‐RACISM concept might be paired with a user group and a documenttype to find evidence of specific suspected violations.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Policies | Policies.• On your McAfee DLP appliance, select Policies.2 Open a policy, then a rule.The Edit Rule page appears.3 Open the Content category.4 Select Concept | is any of and click ?.McAfee Data Loss Prevention 9.2.2 Product Guide 237